0dac35ef3ea77e955f532016cbc1f4b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0dac35ef3ea77e955f532016cbc1f4b2_JaffaCakes118
Size

191KB
MD5

0dac35ef3ea77e955f532016cbc1f4b2
SHA1

684f74d43652378c12c627226460d3e4eef2838c
SHA256

d04fe3e6f4fef1eed2820ef26c632f3c7cb53800bd47da72f2623223b38003d3
SHA512

3aa4d6406fcf57e394006df95d724f095977f6537e662544bb750e3dd8069849046e9b84fb9a8a55f1c4d0d00c5a3087427c5790be859fbfbbeb140c90898147
SSDEEP

1536:pJ3yM+8az86UeW9i9l/QxPkVKp6LtA7S:/Jl+TWIj/QxSq6LtmS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dac35ef3ea77e955f532016cbc1f4b2_JaffaCakes118

Files

0dac35ef3ea77e955f532016cbc1f4b2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35300bd9d964e8ca8778ea6cc3adbe96

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesA
lstrcatA
GetSystemDirectoryA
GetTempPathA
HeapFree
HeapAlloc
GetProcessHeap
FreeResource
LockResource
SetLastError
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
Sleep
DeleteFileA
SwitchToThread
CreateEventA
OpenEventA
GetModuleFileNameA
GetCurrentThreadId
MoveFileExA
MoveFileA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTickCount
SetFilePointer
GetLastError
FindResourceA
LoadResource
CreateFileA
SizeofResource
WriteFile
CloseHandle
FreeLibrary
LoadLibraryA
GetVersionExA
VirtualAlloc
GetModuleHandleA
GetProcAddress
TerminateProcess
WaitForSingleObject
GetLocaleInfoA
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
VirtualQuery
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
SetStdHandle
InitializeCriticalSection
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetInputState
PostThreadMessageA
GetMessageA
SendMessageTimeoutA
wsprintfA

advapi32

GetAce
GetUserNameA
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA

netapi32

NetUserGetLocalGroups
NetApiBufferFree

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35300bd9d964e8ca8778ea6cc3adbe96

Headers

File Characteristics

Imports

kernel32

user32

advapi32

netapi32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 133KB - Virtual size: 133KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 133KB - Virtual size: 133KB